Problem

MiMo's token-plan gateway (token-plan-cn.xiaomimimo.com) returns a transient 401 under load / quota / gateway hiccups, not a 429. Two things turned that into an apparent dead key (#3146):

1. We never retry a 401 — RetryableStatus treats every 4xx as unrecoverable.
2. Every 401 is shown as "API key is missing, wrong, or expired", so a key that's actually fine reads as expired.

Users reported a working key "expiring" mid-session; re-entering the same key fixed it — but only because saving the key rebuilds the connection, not because the key changed. We do not delete the key anywhere; the 401 came from the server.

Fix

• Retry transient 401s for a known-good key. SendWithRetry now takes a SendOptions with RetryAuth (true once a request on this client has succeeded) and KeyPresent. A 401/403 on a key that has authenticated before backs off and retries up to maxAuthRetries (2); a key that has never worked still fails fast, so a genuinely bad key isn't hammered.
• Clearer message. AuthError.HasKey lets the UI distinguish:
  • no key configured → "API key is missing or unset…"
  • key sent but rejected → "the server rejected your API key… may be a transient auth/quota issue — retried with backoff and still failed; try again shortly."

Wired through both the OpenAI-compatible provider (MiMo / DeepSeek / MiniMax) and Anthropic.

Tests

• SendWithRetry retries a transient 401 for a known key and recovers (3 calls); gives up after maxAuthRetries with HasKey=true; still fails fast for a never-authed key.
• explainError selects the missing vs. server-rejected message by HasKey.

Closes #3146